Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Using eBPF to see through encryption without a proxy

github.com

Post reply on HN
Print view View original

51–60 of 80 posts

Re: Show HN: Using eBPF to see through encryption without a proxy

#52

Post by jonfriesen »

tecleandor wrote: post #48

Can it output pcap files or anything similar I can import onto Wireshark or a similar tool? Haven't found anything checking the docs...

As of today, we don't output pcap or har files though these are additions I'd like to make in the future, they aren't currently on our near term roadmap.

Re: Show HN: Using eBPF to see through encryption without a proxy

#53

Post by mrbluecoat »

Was going to ask if it was only passive monitoring or active controlling and found https://docs.qpoint.io/appendix/qcontrol-beta

> Security enforcement: Allowing or denying traffic based on precise conditions

Very cool. What are your supported log sinks?

Re: Show HN: Using eBPF to see through encryption without a proxy

#54

Post by jonfriesen »

ebb_earl_co wrote: post #44
zxilly wrote: post #38

There's a similiar tool https://github.com/gojue/ecapture

I was just about to ask what the difference is here with `ecapture`

`ecapture` has been around for a while and do a lot of great stuff and a lot of functionality overlaps.

Our aim is to make Qtap extensible and via a plugin system. We have http1/2 streaming capabilities and a plugin engine to run these in what we call a stack. Our goal is to add more protocols, like gRPC in the near future.

We have a few example plugins that do things like report request/response's and push access information to standard out in a console or structure log format. Our Pro version has a few more plugins like the ability to report errors (eg. an AI agent is getting HTTP 429 errors). These can be pushed to a service or log aggregator.

To summarize, we do a lot of the same things that ecapture does. We'd like to be less of a tool and more of a "always running" that ops, opsec, and devs use to answer tough questions. We look forward to open sourcing more of plugins as they mature!

Re: Show HN: Using eBPF to see through encryption without a proxy

#55

Post by jonfriesen »

mrbluecoat wrote: post #53

Was going to ask if it was only passive monitoring or active controlling and found https://docs.qpoint.io/appendix/qcontrol-beta > Security enforcement: Allowing or denying traffic based on precise conditions Very cool. What are your supported log sinks?

Thanks! We're really excited about Qcontrol and what it will be able to provide! The rules in that doc are powered by our Rulekit project https://github.com/qpoint-io/rulekit if you're curious about seeing more.

As far as log sinks, we have stdout right now. We have been working on Fluentbit and will eventually add a bunch more. If you have a request, drop them here!

We also have a services concept which support an "event store" and "object store", where the object store handles artifacts that may contain sensitive data and don't need to be indexed for search/aggregation (this is an S3 compliant store). The event store handles all of the events from connection audit logs (these cover the ip protocol level) to individual http request/response pairs. The event store is a custom API we use and need to write some proper documentation for, stay tuned!

Re: Show HN: Using eBPF to see through encryption without a proxy

#58

Post by mrbluecoat »

jonfriesen wrote: post #55
mrbluecoat wrote: post #53

Was going to ask if it was only passive monitoring or active controlling and found https://docs.qpoint.io/appendix/qcontrol-beta > Security enforcement: Allowing or denying traffic based on precise conditions Very cool. What are your supported log sinks?

Thanks! We're really excited about Qcontrol and what it will be able to provide! The rules in that doc are powered by our Rulekit project https://github.com/qpoint-io/rulekit if you're curious about seeing more. As far as log sinks, we have stdout right now. We have been working on Fluentbit and will eventually add a bunch more. If you have a request, drop them here! We also have a services concept which support an "…

My vote would be https://vector.dev/ or https://nanomq.io/ over Fluent Bit for performance reasons. That said, S3/MinIO is fairly universal so that along with stdout should be fine. I'd be interested to learn more about your custom local Pulse Service: https://docs.qpoint.io/readme/data-flow#fully-self-hosted-ma...

Re: Show HN: Using eBPF to see through encryption without a proxy

#59

Post by otterley »

jonfriesen wrote: post #55
mrbluecoat wrote: post #53

Was going to ask if it was only passive monitoring or active controlling and found https://docs.qpoint.io/appendix/qcontrol-beta > Security enforcement: Allowing or denying traffic based on precise conditions Very cool. What are your supported log sinks?

Thanks! We're really excited about Qcontrol and what it will be able to provide! The rules in that doc are powered by our Rulekit project https://github.com/qpoint-io/rulekit if you're curious about seeing more. As far as log sinks, we have stdout right now. We have been working on Fluentbit and will eventually add a bunch more. If you have a request, drop them here! We also have a services concept which support an "…

Standard output is all you need. Let a consumer on the other end do the rest of the work. Don’t make supporting every log collector under the sun your problem. Add OTel support if you really feel the need to.
Post reply on HN